Setup[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
Setup.exe
Size 5.8MB
Sample240703-nrpces1bjf
SHA256 8c09b0520cd0a587ccdab5f16b202ef013d9bf3b4fc7653b5afdf480417d33f1
MD5 c34e8f27e5e41acc13f476298be901f5
SHA1 1857dfcf2bbb4e91fed3595395cc6ea1b6e5e425
SHA512 ccc416d96d36b792c59bdfd23c5e2e3b2c08c3498e43af7e0e5b873e0828c23fb30c1f21428fb8f984df99255d232e718422ce95acc8bba888da082f465c6709
SSDEEP 98304:vsMDHDRm8rcgEqQQ5izvWtb2ZaQ9kclxrg/bYzO6TEYJYEHjHO:RHDRLrcgEq55izvWtDaxbBOLYJYmu
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

File Explorer

Setup.exe

.exe 5.8MB

Setup.exe

IMPHASH fc0d8ac831316f17cc2e481a4218dd73
SHA256 8c09b0520cd0a587ccdab5f16b202ef013d9bf3b4fc7653b5afdf480417d33f1
MD5 c34e8f27e5e41acc13f476298be901f5
SHA1 1857dfcf2bbb4e91fed3595395cc6ea1b6e5e425
SHA512 ccc416d96d36b792c59bdfd23c5e2e3b2c08c3498e43af7e0e5b873e0828c23fb30c1f21428fb8f984df99255d232e718422ce95acc8bba888da082f465c6709
SSDEEP 98304:vsMDHDRm8rcgEqQQ5izvWtb2ZaQ9kclxrg/bYzO6TEYJYEHjHO:RHDRLrcgEq55izvWtDaxbBOLYJYmu
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

PE Signature issue

Digest

77:9e:b3:42:e4:a7:23:1b:7e:75:5f:70:f0:ed:6a:03:9f:cb:bb:36:ae:20:a5:60:a1:ae:20:d6:89:32:af:ab

Digest Algorithm

sha256

PE Digests Matches

Not matched

Trusted

Signing Certificate

SERIALNUMBER=23638777,CN=ASUSTeK COMPUTER INC.,O=ASUSTeK COMPUTER INC.,L=Beitou District,ST=Taipei City,C=TW,1.3.6.1.4.1.311.60.2.1.3=#13025457,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Chains

Sep 13, 2023

SERIALNUMBER=23638777,CN=ASUSTeK COMPUTER INC.,O=ASUSTeK COMPUTER INC.,L=Beitou District,ST=Taipei City,C=TW,1.3.6.1.4.1.311.60.2.1.3=#13025457,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

SERIALNUMBER=23638777,CN=ASUSTeK COMPUTER INC.,O=ASUSTeK COMPUTER INC.,L=Beitou District,ST=Taipei City,C=TW,1.3.6.1.4.1.311.60.2.1.3=#13025457,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

SERIALNUMBER=23638777,CN=ASUSTeK COMPUTER INC.,O=ASUSTeK COMPUTER INC.,L=Beitou District,ST=Taipei City,C=TW,1.3.6.1.4.1.311.60.2.1.3=#13025457,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0f:d1:bb:ca:79:6b:d7:f8:dd:4c:82:e1:0a:9a:96:31

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jan 13, 2022 - Nov 9, 2031

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

SERIALNUMBER=23638777,CN=ASUSTeK COMPUTER INC.,O=ASUSTeK COMPUTER INC.,L=Beitou District,ST=Taipei City,C=TW,1.3.6.1.4.1.311.60.2.1.3=#13025457,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Serial Number

0b:be:02:c8:83:8f:bf:02:ab:56:ed:ab:b1:e3:4c:19

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Oct 22, 2021 - Oct 22, 2024

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Serial Number

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jul 14, 2023 - Oct 13, 2034

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Serial Number

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Mar 23, 2022 - Mar 22, 2037

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

Major OS version

Entry point

3067309

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

D:\Jenkins\workspace\AURAServiceSetup\Release\LightingService.pdb

powrprof

CallNtPowerInformation

avrt

AvSetMmThreadCharacteristicsW AvRevertMmThreadCharacteristics

winmm

timeKillEvent timeSetEvent timeGetDevCaps timeEndPeriod timeBeginPeriod

wtsapi32

WTSEnumerateSessionsW WTSFreeMemory WTSQueryUserToken

userenv

DestroyEnvironmentBlock CreateEnvironmentBlock

kernel32

FlushFileBuffers ReadFile WriteFile PeekNamedPipe DecodePointer RaiseException InitializeCriticalSectionEx DeleteCriticalSection GetCurrentDirectoryW CreateThread SetThreadPriority TerminateThread GetExitCodeThread ResumeThread GetCurrentProcessId GetCurrentThreadId GetCommandLineW InitializeCriticalSection EnterCriticalSection LeaveCriticalSection GetModuleHandleW LoadLibraryExW LoadResource SizeofResource FindResourceW SetDllDirectoryW GetEnvironmentVariableW HeapDestroy HeapAlloc HeapReAlloc HeapFree HeapSize GetProcessHeap LocalFree FormatMessageW GetPrivateProfileStringW GetPrivateProfileSectionNamesW CreateDirectoryW GetFileAttributesW LocalAlloc lstrcmpW GetSystemTimes FormatMessageA GetWindowsDirectoryW FindResourceExW LockResource SetThreadExecutionState GetFileAttributesExW WritePrivateProfileStringW SetWaitableTimer CancelWaitableTimer WaitForMultipleObjects CreateWaitableTimerW DeleteFileW SetEnvironmentVariableW GetFullPathNameW FileTimeToSystemTime SystemTimeToTzSpecificLocalTime GetFileType GetDriveTypeW VirtualQuery GetModuleHandleExW ExitThread RtlUnwind UnregisterWaitEx QueryDepthSList InterlockedFlushSList InterlockedPushEntrySList InterlockedPopEntrySList ReleaseSemaphore VirtualFree VirtualProtect VirtualAlloc GetVersionExW OutputDebugStringW GetTickCount64 QueryPerformanceFrequency QueryPerformanceCounter GetModuleFileNameA CreateEventW ResetEvent SetEvent lstrcmpiW SetThreadAffinityMask GetCurrentThread TerminateProcess GetLastError DuplicateHandle WaitForSingleObject CloseHandle GetModuleFileNameW FreeLibrary WideCharToMultiByte MultiByteToWideChar GetModuleHandleA GetTickCount GetSystemInfo GetCurrentProcess LoadLibraryW GetProcAddress Sleep ExitProcess GetStdHandle GetFileSizeEx GetConsoleMode ReadConsoleW GetDateFormatW FreeLibraryAndExitThread GetThreadTimes UnregisterWait RegisterWaitForSingleObject GetProcessAffinityMask GetNumaHighestNodeNumber DeleteTimerQueueTimer ChangeTimerQueueTimer CreateTimerQueueTimer GetLogicalProcessorInformation GetThreadPriority SignalObjectAndWait CreateTimerQueue InitializeSListHead GetStartupInfoW IsDebuggerPresent IsProcessorFeaturePresent SetUnhandledExceptionFilter UnhandledExceptionFilter GetLocaleInfoW LCMapStringW CompareStringW GetCPInfo GetSystemTimeAsFileTime TlsFree TlsSetValue TlsGetValue TlsAlloc InitializeCriticalSectionAndSpinCount SetLastError EncodePointer AcquireSRWLockShared AcquireSRWLockExclusive ReleaseSRWLockShared ReleaseSRWLockExclusive SwitchToThread WaitForSingleObjectEx GetStringTypeW AreFileApisANSI SetFilePointerEx SetEndOfFile GetFileInformationByHandle FindNextFileW FindFirstFileExW FindClose TryEnterCriticalSection CreateFileW GetTimeFormatW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW GetConsoleCP SetStdHandle GetTimeZoneInformation IsValidCodePage GetACP GetOEMCP GetCommandLineA GetEnvironmentStringsW FreeEnvironmentStringsW WriteConsoleW RemoveDirectoryW

user32

CreateWindowExW TranslateMessage DispatchMessageW RegisterPowerSettingNotification PostThreadMessageW DefWindowProcW PostQuitMessage RegisterClassExW DestroyWindow ShowWindow CharUpperW CharNextW UpdateWindow MessageBoxW LoadCursorW LoadIconW RegisterDeviceNotificationW UnregisterDeviceNotification wsprintfW LoadStringW MessageBoxA GetMessageW

gdi32

GetObjectW DeleteObject

advapi32

RegisterServiceCtrlHandlerW InitializeSecurityDescriptor SetSecurityDescriptorDacl SetNamedSecurityInfoW RegCloseKey RegCreateKeyExA RegOpenKeyExA RegQueryInfoKeyA RegQueryInfoKeyW RegQueryValueExA RegQueryValueExW RegSetValueExW BuildTrusteeWithSidW GetNamedSecurityInfoW GetAce FreeSid EqualSid DeleteAce AllocateAndInitializeSid CreateProcessAsUserW RegEnumValueW StartServiceW StartServiceCtrlDispatcherW SetServiceStatus OpenServiceW OpenSCManagerW DeleteService CreateServiceW ControlService CloseServiceHandle ChangeServiceConfigW RegEnumKeyExW RegDeleteValueW RegDeleteKeyW ReportEventW RegisterEventSourceW DeregisterEventSource RegCreateKeyExW RegOpenKeyExW

ole32

CoRevokeClassObject CoAddRefServerProcess CoRegisterClassObject CoUninitialize CoInitializeEx CLSIDFromProgID CoReleaseServerProcess CoInitializeSecurity StringFromGUID2 CoTaskMemAlloc CoTaskMemRealloc CoTaskMemFree StringFromCLSID CLSIDFromString PropVariantClear CoCreateInstance CoResumeClassObjects

oleaut32

SysAllocString VarUI4FromStr LoadTypeLi LoadRegTypeLi RegisterTypeLi GetErrorInfo UnRegisterTypeLi SysStringByteLen SafeArrayGetUBound SafeArrayGetLBound SafeArrayGetElement VariantInit SysFreeString VariantClear SysStringLen

ws2_32

WSAStartup WSACleanup WSAGetLastError setsockopt htonl inet_addr socket send recv htons connect closesocket inet_pton

crypt32

CertCloseStore CertFindCertificateInStore CertFreeCertificateContext CertGetNameStringW CryptMsgGetParam CryptMsgClose CryptQueryObject

shlwapi

PathFileExistsW StrCpyNW PathFileExistsA

pdh

PdhOpenQueryW PdhGetFormattedCounterValue PdhAddEnglishCounterW PdhCollectQueryData PdhCloseQuery

wintrust

WinVerifyTrust

Sharing

General

Malware Config

Signatures

File Explorer

Setup.exe

PE Signature issue

powrprof

avrt

winmm

wtsapi32

userenv

kernel32

user32

gdi32

advapi32

ole32

oleaut32

ws2_32

crypt32

shlwapi

pdh

wintrust

generic